Description
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-09-15
Score: 10 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution and System Takeover
Action: Patch Immediately
AI Analysis

Impact

A flaw Central component with network access via HTTP to fully compromise the application. The vulnerability allows the attacker to bypass authentication and gain unrestricted control, potentially tampering with or redirecting the security services that protect other Fusion Middleware products. This platform and broader impact due to the scope change property of the flaw.

Affected Systems

The vulnerability affects Oracle Platform Security for Java 12.2.1.4.0 and 14.1.2.0.0. These are the only officially supported versions impacted, and attackers can target them via HTTP without authentication.

Risk and Exploitability

The CVSS is 10.0, indicating maximum severity for confidentiality, integrity, and availability. The EPSS indicates a very low exploited probability (<1%), and the flaw is not currently listed in CISA’s KEV catalog. The likely attack vector is a network-based HTTP request that does not require authentication, making it easily exploitable. Due to the scope change, exploitation of this takeover and potentially affect other connected services.

Generated by OpenCVE AI on September 17, 2026 at 06:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Oracle’s vendor patch or upgrade Oracle Platform Security for Java to a version where the flaw is fixed.
  • If a patch is not yet available, limit HTTP access to the Platform Security for Java service to trusted hosts only or block the relevant ports from the public network.
  • Ensure authentication is properly enforced on the Platform Security for Java endpoints and monitor logs for suspicious activity that may indicate exploitation attempts.

Generated by OpenCVE AI on September 17, 2026 at 06:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Attack on Oracle Platform Security for Java Enables Full System Takeover

Wed, 16 Sep 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287
CWE-306

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle platform Security For Java
CPEs cpe:2.3:a:oracle:platform_security_for_java:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:platform_security_for_java:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle platform Security For Java
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Platform Security For Java
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T03:57:27.840Z

Reserved: 2026-08-31T15:40:57.331Z

Link: CVE-2026-83020

cve-icon Vulnrichment

Updated: 2026-09-15T22:58:51.924Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:18:09.060

Modified: 2026-09-17T04:18:01.663

Link: CVE-2026-83020

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T06:30:09Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function